0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
Size

3.1MB
MD5

fb044ebb44a937d699a7d7cd71e705ca
SHA1

13b7960e547e52fb67a01893230ce362f860f063
SHA256

0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1
SHA512

98b5a2b26aae88d85c7c74219e95196c189c11bcde36f088807dbc03be570f50c49dfcd5a3d7fac7ab027758c5bcddaf81c9331012f82e7cdfcae7fe2f4e5376
SSDEEP

49152:4d+NgJ/rHVW9cwhw5bSTLj7TxNHIAy1h4atUQFKZ9AGj8Q35Mi1Z9oOs4f:4d+SxxSiyBywaSQFKF8Wg4f

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

Processes:

0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe

pid	process
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
1788	0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe
"C:\Users\Admin\AppData\Local\Temp\0080f77349daee5b7d5d9835408ad0380fbc11b982befdb95c7ef90f6f0a3bb1.exe"
1⤵
- Loads dropped DLL
PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\Base64.dll

Filesize
4KB

MD5
f0e3845fefd227d7f1101850410ec849

SHA1
3067203fafd4237be0c186ddab7029dfcbdfb53e

SHA256
7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554

SHA512
584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\DialogEx.dll

Filesize
22KB

MD5
ec138e15734e89232ed5a0e5ee5944ec

SHA1
8ec0f8460f2ac604a22de1b2d531766c80000d04

SHA256
71a46c7173d9c25b9e918a75fa12582ac2404d1b76eb54b28009ac5b73acd3fa

SHA512
4084a5903c2c2a0c2246b11ae61f122939d2e5273f4be0cd97dad6ba70501323edf18b9be0b8cfde23a3e752a695daacf87a596334c87c3a7217239916bd8bc1

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nsdEABF.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1788-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download